TablePlus / TablePlus

TablePlus macOS issue tracker
https://tableplus.com
3.45k stars 57 forks source link

Security risk: Database names should have backslash in permissions #3027

Open blt950 opened 1 year ago

blt950 commented 1 year ago

Please answer the questions below, it helps us to keep track of the issue. Please do not ignore it or your issue will be closed.

  1. Which driver are you using and version of it (Ex: PostgreSQL 10.0): MySQL 8

  2. Which TablePlus build number are you using (the number on the welcome screen, Ex: build 81): 496

  3. The steps to reproduce this issue: When granting privileges in TablePlus (Win + Mac), it should reference the database like prod\_forums instead of prod_forums. This is because an underscore is a wildcard character in MySQL. A backslash is needed before an actual underscore for it to be treated literally. Otherwise prod_forums might match as prod*forums such as prodaforums prodbforums etc.

Note! This is also the reason User Management (Win+Mac) doesn't display the database level priviliges as it can't match the correctly formated record prod\_forum with prod_forum. So this GUI element needs also support for this.

huyphams commented 1 year ago

Thanks, let me test it.